-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
1.0
- Loading branch information
Showing
4 changed files
with
463 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
FROM golang:1.21.5-alpine AS builder | ||
WORKDIR /app | ||
COPY go.mod ./ | ||
|
||
RUN go mod download | ||
COPY . . | ||
RUN CGO_ENABLED=0 go build -o sneakpeeker . | ||
|
||
|
||
FROM gcr.io/distroless/static-debian11 | ||
WORKDIR /root/ | ||
COPY --from=builder /app/sneakpeeker . | ||
|
||
ENTRYPOINT ["./sneakpeeker"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,100 @@ | ||
# SneakPeeker | ||
|
||
SneakPeeker is a tool designed to detect suspicious URLs in various file formats. It processes ZIP, DOCX, XLSX, PPTX, and PDF files to uncover hidden links that might indicate unauthorized access or data leaks. | ||
|
||
## Features | ||
|
||
- Scans directories and files for suspicious URLs | ||
- Supports ZIP, DOCX, XLSX, PPTX, and PDF file formats | ||
- Outputs found URLs to the console | ||
- Optionally removes canary tokens from files | ||
- Generates a JSON report file | ||
|
||
## Installation | ||
|
||
1. Clone the repository: | ||
```bash | ||
git clone https://github.com/Lercas/SneakPeeker.git | ||
cd SneakPeeker | ||
``` | ||
|
||
2. Build the tool: | ||
```bash | ||
go build -o sneakpeeker main.go | ||
``` | ||
|
||
## Usage | ||
|
||
```bash | ||
./sneakpeeker [-f] [-r report_file] FILE_OR_DIRECTORY_PATH | ||
``` | ||
|
||
### Parameters | ||
|
||
`-f`: (Optional) Remove canary tokens from files. | ||
`-r report_file`: (Optional) Specify the name of the JSON report file. Default is report.json. | ||
`FILE_OR_DIRECTORY_PATH`: Path to the file or directory you want to scan. | ||
|
||
## Examples | ||
|
||
Scan a directory and output results to the console: | ||
|
||
```bash | ||
./sneakpeeker /path/to/directory | ||
``` | ||
|
||
Scan a file and output results to the console: | ||
|
||
```bash | ||
./sneakpeeker /path/to/file.docx | ||
``` | ||
|
||
Scan a file and remove canary tokens: | ||
|
||
```bash | ||
./sneakpeeker -f /path/to/file.pdf | ||
``` | ||
|
||
Scan a file and generate a JSON report: | ||
|
||
```bash | ||
./sneakpeeker -r myreport.json /path/to/file.pdf | ||
``` | ||
|
||
How It Works | ||
|
||
- PDF Files: Scans for URL patterns in decompressed PDF streams. | ||
- ZIP, DOCX, XLSX, PPTX Files: Decompresses the files and scans for URL patterns in the extracted contents. | ||
|
||
Example Output | ||
|
||
```bash | ||
[INFO] The file /path/to/file.docx is suspicious. URLs found: | ||
http://suspicious-example.local | ||
https://another-suspicious-example.local | ||
|
||
[INFO] The file /path/to/anotherfile.pdf seems normal. | ||
``` | ||
|
||
## Docker Usage | ||
|
||
First, build the Docker image: | ||
|
||
```bash | ||
docker build -t canarycatcher:1.0 . | ||
``` | ||
|
||
Then, run the container with volume mounting to access your files. For example, if you want to scan the /path/to/scan directory on your host, you can run: | ||
```bash | ||
docker run --rm -v /path/to/scan:/data canarycatcher:1.0 /data | ||
``` | ||
|
||
If you want to use additional flags -f to remove canary tokens, you can do so as follows: | ||
```bash | ||
docker run --rm -v /path/to/scan:/data canarycatcher:1.0 -f /data | ||
``` | ||
|
||
Example command to run with a JSON report: | ||
```bash | ||
docker run --rm -v /path/to/scan:/data canarycatcher:1.0 -r /data/report.json /data | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
module SneakPeeker | ||
|
||
go 1.21.5 |
Oops, something went wrong.